IronbarkAML
Check an ABN
Sub-processors · published 2026-04-25

Every third party that processes your data.

Listed by tier. Updated within 30 days of any change. Email security@ironbarkaml.com.au to subscribe to changes.

Amazon Web Services (AWS)

Critical
Service
Cloud infrastructure (compute Phase 2+, S3 Object Lock audit log, KMS)
Country
AU (ap-southeast-2 Sydney, ap-southeast-4 Melbourne DR)
Data received
Customer data (encrypted, KMS-protected); 7-year audit log
Certifications
SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, IRAP PROTECTED, PCI DSS, FedRAMP, FIPS 140-3 Level 3 KMS
Swap path
GCP ap-southeast-1 or Azure Australia East (6-month migration)

Cloudflare

Critical
Service
WAF, DDoS, CDN, DNS
Country
Global edge POPs; control plane US
Data received
HTTP request metadata, customer data in transit
Certifications
SOC 2 Type II, ISO 27001, PCI DSS, FedRAMP
Swap path
Fastly or AWS CloudFront + Shield (4-week swap)

Supabase

Critical
Service
Managed Postgres, authentication, storage
Country
AU (ap-southeast-2 Sydney)
Data received
Customer data (full)
Certifications
SOC 2 Type II, HIPAA-eligible, GDPR-aligned
Swap path
AWS RDS Postgres + Cognito or Neon + Auth0 (8-week migration)

GitHub

Critical
Service
Source code, Actions CI/CD, CodeQL, Dependabot
Country
US (control plane); global CDN
Data received
Source code (no customer data); CI/CD logs
Certifications
SOC 1 Type II, SOC 2 Type II, ISO 27001, FedRAMP
Swap path
GitLab self-hosted or Bitbucket (2-week repo migration)

Stripe (Phase 4 trigger)

Critical
Service
Card payments, subscription billing, Stripe Bridge USDC settlement
Country
US (control plane); processing per acquirer region
Data received
Payment-method tokens (PAN never lands in Ironbark, SAQ-A scope)
Certifications
PCI DSS Level 1, SOC 1 Type II, SOC 2 Type II, ISO 27001
Swap path
PayTo direct (Zepto / Monoova) for AU bank-to-bank rails

Anthropic (Phase 3 trigger)

Standard
Service
Claude LLM API (Phase 3+ AI agents)
Country
US (control plane; processing US/EU)
Data received
Prompts (PII-excluded by default; opt-in only); no training data use
Certifications
SOC 2 Type II, ISO 27001 (in scope), HIPAA-aligned via Trust Tier
Swap path
AWS Bedrock (Claude in AU region) or OpenAI (re-tuning required)

Twilio (Phase 4 trigger)

Standard
Service
SMS, WhatsApp Business
Country
US (control plane); processing per region
Data received
Phone numbers, message content (transactional)
Certifications
SOC 2 Type II, ISO 27001, HIPAA-eligible, GDPR-aligned
Swap path
android-sms-gateway (self-hosted, AU SIM, zero per-SMS cost)

Firecrawl

Standard
Service
Web scraping (research provider, internal lead-enrichment surface only)
Country
US (control plane)
Data received
Target URLs and page content (no customer PII)
Certifications
SOC 2 in progress
Swap path
Apify or in-house BeautifulSoup + Playwright

Apify

Standard
Service
Web scraping actors (research provider, redundancy validator)
Country
Czech Republic (control plane)
Data received
Target URLs and page content (no customer PII)
Certifications
SOC 2 Type II, ISO 27001, GDPR-aligned
Swap path
Firecrawl or in-house

Exa

Standard
Service
Neural web search + adverse-media search (internal lead-enrichment surface only)
Country
US (control plane)
Data received
Search queries (no customer PII)
Certifications
SOC 2 in progress
Swap path
Perplexity or Brave Search API

Perplexity

Standard
Service
Sonar API + citation retrieval (internal Q&A oracle)
Country
US (control plane)
Data received
Queries (no customer PII)
Certifications
SOC 2 Type II in scope
Swap path
Anthropic Claude with native web search or Brave + manual citation

Vercel

Marginal
Service
Marketing site hosting (Next.js)
Country
Global CDN; control plane US
Data received
Page traffic logs (no customer authentication on this surface)
Certifications
SOC 2 Type II, ISO 27001, HIPAA-aligned, GDPR-aligned
Swap path
Cloudflare Pages or AWS Amplify

Railway (migrating Phase 2)

Marginal
Service
Backend hosting (Phase 1; migrating to AWS Fargate ap-southeast-2)
Country
Singapore (asia-southeast1-eqsg3a)
Data received
Customer data in transit + processing (until ADR-005 migration completes)
Certifications
SOC 2 Type II in progress
Swap path
AWS ECS Fargate ap-southeast-2 (locked migration target)

Tier definitions per Policy 09 (Vendor Risk Management):

  • Critical: production-path, customer data flows through, replacement requires architecture change
  • Standard: production-path, customer data flows through, replacement is provider-interface swap
  • Marginal: operational, no customer data flows, easy replacement

Last reviewed: 2026-04-25.

Next review: 2026-07-25.

Source: /security · Policy 09 in ironbark-portfolio-policies